LLM in the Shell: Generative Honeypots

Muris Sladić,Veronica Valeros,Carlos Catania,Sebastian Garcia

DOI: https://doi.org/10.1109/EuroSPW61312.2024.00054

2024-09-23

Abstract:Honeypots are essential tools in cybersecurity for early detection, threat intelligence gathering, and analysis of attacker's behavior. However, most of them lack the required realism to engage and fool human attackers long-term. Being easy to distinguish honeypots strongly hinders their effectiveness. This can happen because they are too deterministic, lack adaptability, or lack deepness. This work introduces shelLM, a dynamic and realistic software honeypot based on Large Language Models that generates Linux-like shell output. We designed and implemented shelLM using cloud-based LLMs. We evaluated if shelLM can generate output as expected from a real Linux shell. The evaluation was done by asking cybersecurity researchers to use the honeypot and give feedback if each answer from the honeypot was the expected one from a Linux shell. Results indicate that shelLM can create credible and dynamic answers capable of addressing the limitations of current honeypots. ShelLM reached a TNR of 0.90, convincing humans it was consistent with a real Linux shell. The source code and prompts for replicating the experiments have been publicly available.

Cryptography and Security,Artificial Intelligence,Computation and Language

What problem does this paper attempt to address?

The paper attempts to address the issue that current honeypot systems lack sufficient realism and dynamism when simulating real systems (such as the Linux shell), making them easily identifiable by human attackers. Specifically, existing shell-based honeypot systems have the following problems:
1. **Limited behavior**: The possible operations are limited.
2. **Overly generic file system**: The structure and content of the file system are not complex or realistic enough.
3. **Hardcoded responses**: The provided answers are too fixed and lack flexibility.
4. **Overall system not complex enough**: The entire system does not appear realistic enough.

To solve these problems, the researchers proposed a new system called shelLM, which is a dynamic honeypot software based on a large language model (LLM). shelLM aims to generate credible and realistic Linux shell outputs, thereby confusing human attackers for a longer period and delaying their realization that they are not interacting with a real Linux shell. By using LLM technology, shelLM can create all information from the file system structure to on-demand file content, thereby improving the effectiveness and realism of the honeypot system.